open Secondary menu

Technology and the Voting Process


VII. Modeling the Voting Technologies

In this section we present narrative summaries of the current voting process and how that process would unfold if voting were to take place using telephone, Internet, or electronic kiosk. Canada's election law is highly detailed so we have endeavored here to present the most important aspects of the process. These models are meant to be illustrative of voting technology possibilities. Other options are possible.

As noted earlier, the issue of effectively identifying eligible voters (e.g., PIN numbers, fingerprints, voice prints, retina scans) is the greatest hurdle for the voting technology options.

Technology experts agree that there are several possible solutions to the personal identification issue; such as, electronic signatures, voice prints, fingerprinting, retina scanning, and smart cards. However, each of these solutions has a cost and raises a number of privacy issues.

Cost problems are likely to be overcome over the medium term as a result of technological advances and falling technology prices. Issues related to privacy are more challenging and will require on-going assessment of Canadians' willingness to use such personal identification devices.

A. Current voting process

We began our modeling efforts by gaining a thorough understanding of the current voting process. By current voting process, we mean that process which the majority of Canadian electors use – voting in person, at the polling station without assistance. It should be noted that there are several variations of this process including special ballots (international, national, local, acute care, incarcerated, and armed forces), advanced and mobile polls, and casting votes with assistance (assistance of a family member, assistance of a friend, or assistance of the DRO and poll clerk).

The following models are presented in seven key process steps. These are: (1) registration confirmation; (2) the ballot; (3) casting a decision; (4) ballot verification and anonymity of the elector; (5) submission of the ballot; (6) vote tabulationFootnote 21 and (7) retention and storage. This modeling is not meant to exhaustively capture the voting process but rather to highlight the key process steps and how the use of technology in these steps would alter the conduct of the current voting process.

1. Registration confirmation

An elector, before receiving a ballot paper from the deputy returning officer (DRO) must give his or her name and address to the DRO and polling clerk and, on request, to an agent of a candidate. Once the elector's eligibility to vote is confirmed the elector's name is crossed off the registered voters list.

2. Ballot

Following registration confirmation, the DRO prepares a ballot for the elector. The DRO initials the ballot, tears the ballot from the ballot book, folds the ballot into three sections, and presents the ballot to the elector.

The DRO instructs each elector on how and where to affix his or her mark on the ballot, shows the elector how to fold and unfold the ballot, and instructs the elector to return the ballot once they have completed making his or her decision.

The elector then proceeds to the private voting area behind a cardboard screen.

3. Casting of decision

The elector unfolds the ballot and marks his or her choice using a pen or pencil in the circular space provided on the ballot opposite the name of the candidate of his or her choice. Should the elector make an error in his or her selection or inadvertently deface the ballot paper, the elector returns the ballot paper to the DRO and is issued a new ballot paper. Each elector is allowed one replacement ballot paper.

4. Ballot verification and anonymity of the elector

The elector then refolds the ballot and returns it to the DRO. The DRO, on receiving the ballot from the elector, without unfolding the ballot, verifies that the ballot is the same one that was handed to the elector by examining the initials and serial number on the back of the ballot thus ensuring that the ballot cast is the one which was handed to the elector by the DRO.

The DRO then removes and destroys the serial number on the ballot in full view of the elector and all other persons present thus separating the identity of the elector from the ballot.

5. Ballot submission

The DRO then returns the ballot to the elector who puts it in the ballot box. If the elector requests it, the DRO shall deposit the ballot in the ballot box. As soon as the elector's ballot paper has been deposited in the ballot box that elector has voted and the poll clerk so indicates opposite the elector's name on the register list.

6. Vote tabulation

Immediately after the close of the poll, in the presence and in full view of the poll clerk and all other persons present (e.g., candidates and his or her agents), the DRO: counts the number of electors who have voted; counts the spoiled ballot papers; counts the unused ballot papers; and checks the number of ballot papers supplied by the returning officer against the number of spoiled ballot papers, the number of unused ballot papers and the number of electors listed as having voted. The number of ballots supplied must equal the total number counted at this point before proceeding.

The DRO then opens the ballot box and empties its contents on a table and counts the number of votes given to each candidate on provided tally sheets.

If in the course of counting the votes a ballot paper is found with the serial number still attached, the DRO will, while shielding that number from other witnesses protecting the identity of the elector, remove and destroy the serial number. The vote is then counted.

In addition, if, in the course of counting votes, the DRO comes across a ballot which does not bear his initials he shall affix his initials in the presence of the witnesses and count the vote if he is satisfied that the ballot paper was supplied to him, an omission has been made, and all ballot papers are accounted for.

All ballot papers that are not rejected by the DRO are counted and a list kept of the number of votes given each candidate.

Once this is completed, the DRO prepares a statement of the poll.

7. Retention and storage

Envelopes, containing the unused, rejected or spoiled ballot papers, those counted for each candidate, the official list of electors, and other documents used at the poll, are placed in the ballot box and sealed with seals prescribed by the Chief Electoral Officer and transmitted to the returning officer.

B. Vote by telephone

The use of many technology voting options require the user (voter) to have in his or her possession, some unique identifier recognizable by the voting system. A personal identification number (PIN) similar to that issued by financial institutions for the use of debit or credit cards has been used by some past leadership contests. In these cases, the PINs were generated by an approved third party under the supervision of a national audit firm. The PIN generation process itself can be designed such that integrity and confidentiality can be assured.

PINs can then be assigned to registered voters on a random basis and provided in secure transmittal vehicles (mail envelopes). Once again, there are well established PIN print and mail routines generally accepted and used by all major financial institutions and others. The delivery of PINs is still reported periodically as a problem as there is limited control over the mail delivery system. Multi-residential complexes have reported mail loss.

Use of the telephone as a means of increasing accessibility to the voting process is an attractive option for a number of reasons including the near universal presence of telephones in Canadian households, electors' familiarity with the device and how it works, and the fact that an elector would not need to attend the polling station to vote. For these reasons, telephone voting is the most viable of the three voting options we assessed.

The main challenges to telephone voting include system limitations, providing access for physically disabled electors, electors whose language is not English or French, electors with rotary dial telephones who could not take advantage of this option, and the issuance of personal identification numbers (PINs) to electors so that they can access telephone voting.

In terms of systems limitations (which limit the volume of calls at any given time), Canadian telephone companies are updating their telephone switches across the country from analog to digital. Digital switches have much greater capacity and are better suited to handle the volume of calls associated with elections.

Advances in integrated voice technology have made it possible for electors to speak when voting instead of using a touch tone pad to cast their decision. This makes telephone voting an option for those with rotary dial telephones and those who lack the manual dexterity which would be necessary when using a touch tone pad. In addition, integrated voice technology offers multi-lingual capabilities so that voters could complete the voting process in languages other than French or English.

The issuance and subsequent assurance that the "right person has the right PIN" remains telephone voting's most significant challenge. As we will demonstrate below, the telephone voting process begins with an elector telephoning the voting number and inputting a PIN to confirm his or her eligibility to vote. The question remains as to how one securely provides that PIN to the elector and how one ensures that once the elector has the PIN the elector continues to hold his or her PIN and only that PIN and that when voting from a remote location that elector is able to vote without any outside influences. In essence, the two main issues are: first, ensuring that the elector does not treat their PIN as a marketable commodity to be sold for money or favour; and second, that when voting from a remote location, the elector can make their choice free of coercion. Legislators in the State of Arizona recently voted against any use of the telephone in state elections until these issues could be resolved. While there are a number of options for solving this issue such as electors being prompted upon voting to provide an additional piece of personal information such as mother's maiden name or the numeric digits in their postal code to verify the elector's identity, such measures are still open to voting fraud and coercion. A second option is registering to vote by telephone so that a "voice print" can be taken for eligibility verification later. However, this option would be costly and require the storage of a sizable amount of information.

C. Vote by kiosk (touch screen computer)

The experts we interviewed regarded this option as technologically viable given the maturity of the technology and the availability of public networks (such as the Interac network of banking machines or the HRDC network) which could be used for voting purposes. While the use of publicly available networks is attractive from a cost-effectiveness perspective, it opens up a host of issues associated with security and secrecy. As a result, we focused our efforts on assessing terminals which could be placed in polling stations and portable terminals which could be used in acute care and mobile settings.

D. Vote by Internet

We discovered that Internet-based voting is the least viable of the three technologies reviewed because of shortcomings in both accessibility and security.

Despite the dramatic increase in the number of Canadians who are "on the net," the total number of citizens with access to the Internet is still small. Because the Internet has not penetrated the Canadian household in numbers anywhere close to the telephone, this voting option would only be available to a small number of electors unless computers were provided in polling stations or other public buildings such as libraries.

Security concerns associated with Internet-based voting relate to the link between the elector's computer and the Internet service provider. Once the two computers are linked there is an increased possibility that computer "hackers" could access and manipulate election results. While the experts we spoke to were confident that security issues were surmountable, they suggested that it would take another two or three years to provide a level of security which was acceptable for voting. In addition, Internet-based voting would make it necessary for Elections Canada or a sub-contractor to stay one step ahead of those who may attempt to manipulate its network adding extra expense to managing an event.

E. Electronic voting model

Given the similarities in various process steps across the technologies, we have provided one model below which highlights differences in the technologies as appropriate.

1. Registration confirmation

Telephone

At this step, the elector would dial in to an automated telephone voting service. After prompting the elector to input or verbally identify his or her language of choice, the system would then prompt the elector to either input on the touch tone pad or speak his or her PIN. Technology has been used to detect attempts of fraudulent access to telephone voting systems. When a predetermined number of calls and attempts to input an incorrect PIN is detected the system would terminate the call. For those electors who may be having difficulty inputting or speaking their PIN, the system could be designed to allow them to press "0" or stay on the line for assistance through a designated back-up call centre.

The PIN would be used to confirm eligibility to vote. Because electors could vote from across the country or around the world the PIN would have to have a defined life to facilitate the closing of traditional polls and the tabulation of votes.

Once the elector has been confirmed as eligible to vote, his or her name would be so marked in a database which would be on-line with traditional polling stations and other electronic options available to electors such that an elector could not vote twice. This would require the real time, on-line automation of the register of electors at the polls across traditional and electronic voting options.

In the case of a number of electors calling in at the same time, calls could be placed in queue. Callers whose call was received before poll closing but who could not access the system until after closing would remain eligible to vote so long as their PIN was valid.

Electors would then listen to a message verifying the electoral district in which they were eligible to vote and asked to respond either verbally or by pressing one of the touch tone keys that this information is in fact correct. Should the information be incorrect the voter would have the option of pressing a defined key or staying on the line for assistance.

Kiosk

At this step, the elector would access the automated kiosk. The kiosk could be fully automated handling all voting processes from registration confirmation through tabulation and then send the results to a central repository. With this option the kiosk could be located in a polling station or in unattended public locations. Alternatively, the kiosks could be located within polling stations with certain functions such as registration and tabulation handled by polling station staff. In addition, staff could operate mobile kiosks for use in places such as acute care centres.

After prompting the elector for his or her language of choice, in the unattended situation, electors would either insert a form of "smart card" to set the voting process in motion and then be prompted for a PIN. Alternatively, the kiosk could be designed to commence with the PIN prompt. Technology has been used to detect attempts of fraudulent access to computer systems. When a predetermined number of attempts to input an incorrect PIN is detected the system would terminate access to the site.

The PIN would be used to confirm eligibility to vote. Because electors could vote from across the country or around the world the PIN would have to have a defined life to facilitate the closing of traditional polls and the tabulation of votes.

Once the elector has been confirmed as eligible to vote, his or her name would be so marked in a database which would be on-line with traditional polling stations and other electronic options available to electors such that an elector could not vote twice. This would require the real time, on-line automation of the register of electors at the polls across traditional and electronic voting options. This would be technically-difficult should a remote or portable kiosk-type of device be employed.

Electors would then receive a message identifying the electoral district in which they were eligible to vote and asked to respond by pressing a defined key on the keypad or by using a light pen or their finger on a defined area of the screen. Should the information be incorrect the voter would have the option of pressing a defined key to make necessary corrections.

Internet

At this step, the elector would access the automated voting Web site through a personal computer. After prompting the elector to input his or her language of choice, the system would then prompt the elector to input his or her PIN. Technology has been used to detect attempts of fraudulent access to computer systems. When a predetermined number of attempts to input an incorrect PIN is detected the system would terminate access to the site. For those electors who may be having difficulty inputting or speaking their PIN, the system could be designed to allow them to access a help function either on-line or by calling a telephone help line.

The PIN would be used to confirm eligibility to vote. Because electors could vote from across the country or around the world the PIN would have to have a defined life to facilitate the closing of traditional polls and the tabulation of votes.

Once the elector has been confirmed as eligible to vote, his or her name would be so marked in a database which would be on-line with traditional polling stations and other electronic options available to electors such that an elector could not vote twice. This would require the real time, on-line automation of the register of electors across traditional and electronic voting options.

To ensure greater accessibility to this voting option, Web site access could be provided through public buildings such as libraries or Government of Canada buildings.

Electors would then receive a message identifying the electoral district in which they were eligible to vote and asked to respond by clicking on an "OK" button to verify that this information is in fact correct. Should the information be incorrect the voter would have the option of pressing a defined key to make necessary corrections.

2. Ballot options

Telephone

There are a number of ballot options available. For example, electors could listen to a listing of candidates and their respective selection codes, or electors could be prompted to enter the selection code of their candidate of choice from a paper ballot or other information provided to them in advance of election day.

Kiosk and Internet

As with the telephone, there are a number of ballot options available. For example, electors could be prompted to enter the selection code of their candidate of choice from a paper ballot provided to them in advance of election day, view a list of candidates and their respective selection codes or view a combination of written text and pictures for each candidate.

3. Casting of decision

Telephone

In casting a decision, electors would be prompted to enter the selection code for the candidate of their choice, or in the case of integrated voice technology verbally select the candidate of their choice by responding to "yes" or "no" prompts from the system or by speaking the selection number of the candidate of their choice. The "yes" or "no" option is simpler to administer.

The system would then answer back the elector's choice and ask for either verbal or key pad verification. The elector would also have an opportunity to cancel the selection they had made. The system could be designed to provide the elector with one or more opportunities.

Limitations could be placed on the system to confine the number of attempts an elector would receive at inputting their selection to prevent delays within the system.

Consideration could also be given to extending the voting period similar to the special ballot process to manage volume issues.

Kiosk

Electors would then make their selection by either inputting their chosen candidates selection code on a numerical key pad, or by clicking on their candidate's name, party or picture using a light pen or their finger.

The system would then portray the elector's choice and ask the elector to verify his or her selection using a defined keyboard key or by the light pen or his or her finger. The elector would also have an opportunity at this stage of canceling the selection they had made. The system could be designed to provide the elector with one or more opportunities.

Limitations could be placed on the system to confine the number of attempts an elector would receive at inputting his or her selection to prevent hold ups within the system.

Internet

Electors would then make their selection by either inputting their chosen candidates selection code or by clicking on their candidate's name, party or picture using the keyboard (e.g., arrow and enter keys) or mouse.

The system would then portray the elector's choice and ask the elector to verify their selection using a defined keyboard key or by using the mouse. The elector would also have an opportunity at this stage of canceling the selection they had made. The system could be designed to provide the elector with one or more opportunities.

Limitations could be placed on the system to confine the number of attempts an elector would receive at inputting his or her selection to prevent hold ups within the system.

Consideration could also be given to extending the voting period similar to the special ballot process to manage volume issues.

4. Ballot verification and anonymity of the elector

Once the elector has confirmed his or her selection the ballot would be considered verified and collected by the system. The system would separate the voter's PIN from the ballot at this step.

5. Ballot submission

The ballot would then be stored for tabulation, the PIN canceled, and the voter marked as having voted. As mentioned above, Elections Canada would require "real time" voted status of electors so that electors could not vote twice by attempting to vote at a polling station or through any other option.

6. Tabulation of votes

The system would communicate votes on-line to a central tabulation area where the votes would be counted and redistributed to the appropriate electoral district and polling stations where the returning officers would add the totals to the polling station figures.

7. Retention and storage

Transcripts of recorded votes could be stored either electronically (e.g., diskette format), on paper or both.

F. Conclusions

Our review of the technology reasonably available to support the elements of the voting process concludes that:

  • All three of the new voting technologies (telephone, kiosk and Internet) are sufficiently evolved to support testing in a fully functional pilot.
  • None of the technologies examined or options available in the near future present a universal solution. It is our view that in addition to the present manual vote, vote processes consisting of a combination of telephone, kiosk/terminal and Internet should be considered for future elections.
  • Of the technologies currently available, the kiosk/terminal located in a controlled area presents the highest level of potential security balanced with the least risk. We base this on the observation that reasonably functional devices have been developed and could be readily deployed on a test basis in a controlled manner. However, we believe that the cost of deploying this technology will result in only selected and limited use in Canada.
  • The telephone based option offers the potential for the most significant impact on the largest base of Canadian voters. The telephone is clearly the most accepted and widely available of the relevant technologies. Access issues are largely manageable with careful planning and continuing enhancements to the Canadian telephone infrastructure, which is also readily accessible from outside of the country. Further enhancements to the commercialized use of the telephone infrastructure through interactive data phones such as the Northern Telecom interactive Vista 350 can provide full "kiosk/terminal" functionality to individual households. Finally, recent significant advancements to the commercial use of voice recognition and command systems can lead to the full elimination of the need for telephone key pad interaction, thus further simplifying the use of this technology for Canadians. The Toronto Dominion Bank among others, is one example of a Canadian organization that has announced the introduction of the "Green Line TalkBroker", a market information service responding to spoken word commands. This is similar to the Charles Schwab system implemented in the USA which currently responds to over 350,000 calls daily.

Footnote 21 While vote tabulation is outside of the mandate of this project, it is included in the models to demonstrate the impact that various voting technology options have on the tabulation process.